registry / getsuperpower / 0.3.1

getsuperpower@0.3.1

AI Security Review

scanned 14h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. Explicit commands install skill content into Claude, Codex, Copilot, or Cursor configuration paths. User-selected workflow dependencies may run an external skills CLI.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs `getsuperpower skills install` or `getsuperpower install/clone`.

Impact

Can alter AI-agent behavior in the selected home directory; no unconsented install-time mutation is present.

Mechanism

Agent-skill deployment and user-requested external dependency installation.

Rationale

No concrete malicious behavior was found, but the package deliberately modifies AI-agent extension surfaces when explicitly invoked. Per policy, this first-party agent extension setup warrants a warning rather than a block.

Evidence

package.jsonsrc/cli.tssrc/getsuperpower.tssrc/plugins/skill-installer.tssrc/runtimes/ponytrail/workflow-bundles.tsbundled-skills/pony-trail/hooks/pre-file-change.sh.agents/skills/<skill>.codex/skills/<skill>.claude/skills/<skill>.cursor/rules/<skill>.mdc.getsuperpower/workflows/<name>.json

getsuperpower@0.3.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code